node-forge is vulnerable to ASN.1 OID Integer Truncation

Description

MITRE-Formatted CVE Description An Integer Overflow (CWE-190) vulnerability in node-forge versions 1.3.1 and below enables remote, unauthenticated attackers to craft ASN.1 structures containing OIDs with oversized arcs.

Recommendation

Update the node-forge package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.3.2
• Patched version(s): 1.3.2

References

• GHSA-65ch-62r8-g69g
• CVE-2025-66030
• CWE-190
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Improper Request Caching Lookup in the Auth0 Next.js SDK - CVE-2025-67490
• node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization - CVE-2025-12816
• authkit-nextjs may let session cookies be cached in CDNs - CVE-2025-64762
• @perfood/couch-auth may expose session tokens, passwords - CVE-2025-60794

Tags:

npm

node-forge